“GitHub, for its part, has categorized the issue as informational, requiring that users take it upon themselves to secure their uploaded artifacts.”
Public GitHub Actions artifacts leaked GITHUB_TOKEN and an undocumented ACTIONS_RUNTIME_TOKEN that lives about six hours. Unit 42 found exposed repos from AWS, Google, Microsoft, Red Hat and Ubuntu. With artifacts v4, an attacker grabs the token mid-run and pushes code before it expires. GitHub calls that informational and hands the problem back to its users.